Skip to content

Conversation

@eWert-Online
Copy link
Contributor

Closes #1414

Summary of changes:
This removes the sandbox attribute from the iframe.
As @mfranzke pointed out: Based on the following statement, the attribute is kind of pseudo security

When the embedded document has the same origin as the embedding page, it is strongly discouraged to use both allow-scripts and allow-same-origin, as that lets the embedded document remove the sandbox attribute — making it no more secure than not using the sandbox attribute at all.

@JosefBredereck JosefBredereck merged commit 4335660 into pattern-lab:dev Feb 2, 2022
antonia-rose pushed a commit to quelltexterin/nemo-uikit-workshop that referenced this pull request Apr 12, 2023
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Add allow-downloads to iframe sandbox options

3 participants